Norton for Mac

[RSquared]

Hopefull someone out there has some insight on how to handle this since my Norton software isn't even detecting it.

I ran a copy of ClamXav and it detected 'worm.downadup-9' infection on the 'quarantinefile.qtn' which is part of my norton anti-virus software.

Can I simply delete this or will it mess up my Norton software from running properly?

Everything I have googled about this worm says it a variation on the 'Conficker' worm and can only be found on Windows machines.

If so, why is it coming up on my Mac?

Help!!!!!

[BobP1776]

Windows viruses can be found in Mac systems if they have come in, for example, as an email attachment.  Windows-only viruses can't do any harm to a Mac system, but you still want to get rid of them so that you don't accidentally pass them on to a friend running a Windows computer, for example by forwarding along such an email message.

The "quarantine" file is the place where Norton Antivirus moves files containing nasty stuff to isolate them from the rest of your system.  Files in Quarantine can not run or do any damage.

It sounds like Norton Antivirus may very well have detected this virus at some point in the past and moved the file into Quarantine.  Of course it doesn't report things in Quarantine when you Scan because those wouldn't be meaningful reports.  I.e., such nasty files are SUPPOSED to be in there so you can decide what you want to do with them, such as Delete them.  ClamXAV, on the other hand, doesn't treat the Norton Quarantine as anything special, so when it finds stuff that Norton has put into the Quarantine, it reports those just as if they were found anyplace else.

If you are running the latest version of Norton Antivirus, then in the Tools menu you will find an item that lets you view what items are currently held in Quarantine, so you can take action such as deleting them.

--Bob

[Lee_G]

I believe the structure of the quarantine file should prevent any quarantined items from being detected, even by other scanners.  If that's the case, this could mean ClamAV is giving a false positive on Conficker.  One way to check is to go to the Quarantine item in NAV's Tools menu, and see what it contains.  If it does have Conflcker, let me know.

[RSquared]

When I went into NAV and went to Quarantine under the tools menu the following items are found:

jwgkvsq.vmx with date added jan 30, 2012 status-infected, and

jwgkvsq.vmx with date added dec 30, 2011 status-infected.

i have had some strange things happening on my system for a few months now which is why I decided to start using NAV. For example, when putting my computer to sleep it will mysteriously start up a few minutes later.

or sometimes when I've gone to bed I'll wake up when I see the screen come on when it come out of sleep hours later.

I thought I was getting hacked so I went into my apple settings menu and turned off any incoming connections but one can only live for so long in this condition!

another things I just noticed on my NAV entry screen, under Last Product Update: it reads May 11, 2049

something weird is definitely happening but between NAV and ClamAV this is all I've found so far....

[Lee_G]

Are you using NAV 11 or 12?  I ask because I thought you would be able to see the infection name, but perhaps not in NAV 11.

[RSquared]

Im using Nav 11.1.2 (17).

I guess I just missed out on getting 12 because I just bought my subscription on 12/29/11.

Incidentally I just went through my activity log to see when NAV found what--

It looks like this jwgkvsq file was found during my first virus scan and quarantined back then in December.

Then on Jan 30, 12 it found the w32.downadup.B virus and quarantined that. 

It also found joke.annoygreet which it deleted. It looks like those files were from emails I had gotten from friends.

Then on April 14, 12 it found joke.annoygreet again which it said was deleted, again from email folders on my hard drive.

Strange, I wonder how it ended up coming back after it deleted 3 months earlier...

After that on 5/1/12 I got a Fake App Attack: Fack AV Website 24 from IP address 67.213.222.18

and then on 5/11/49 it said my Norton subscription was expired and couldn't do a liveupdate.

Thank God I finally got some anti-virus software! I had no idea there was so much crap out there!

[Lee_G]

OK, then the quarantine does contain Worm.downadup, so ClamAV is correct. This format was changed in NAV 12.  But as mentioned, there is no concern of a quarantined file causing harm.

[RSquared]

Okay, so what do I do next? Just delete the file?

Is there any chance these viruses are causing the sleep problem I described?

[Lee_G]

You should be able to delete the files from the quarantine window.  Conficker is not a Mac threat, so it wouldn't affect your sleep, and I believe the others are Windows as well.  I am guessing the sleep issue is unrelated.  I am not sure why your date seemed to be incorrect in the virus defs expiration message, did you check that your system date and time are correct?

[RSquared]

I have deleted the files through the quarantine window just as you described.

I seem to be having trouble getting the latest virus defs downloaded and I wonder if there might be a virus on my machine still undetected that has somehow made my NAV think that the time and date is different in order to screw up my subsciption and make my live update think its expired.

My time and date is updated on my computer automatically through apple's time website.

But for instance now my NAV is showing the last time I updated it was in 1978 and the main screen of the software is showing the next update to take place in 2049.

I'm attaching a screenshot to give you a better idea.

Thanks for your help Lee!